The suit dates back to December 2009, when Facebook changed is privacy policy and parts of users’ profiles—such as name, picture, city, gender and friends list—became public by default. When Facebook users complained, privacy advocates filed a complaint with the FTC.

In its suit, the commission said Facebook “deceived consumers by telling them they could keep their information on Facebook private, and then repeatedly allowing it to be shared and made public.”

According to the settlement, Facebook must refrain from “making any further deceptive privacy claims.” The agreement also “requires that the company get consumers’ approval before it changes the way it shares their data, and requires that it obtain periodic assessments of its privacy practices by independent, third-party auditors for the next 20 years.”

Facebook CEO Mark Zuckerberg admitted in a Nov. 29 blog post that the company handled the 2009 transition of its privacy policy poorly, but maintains that Facebook continues to do good work. “But we can also always do better,” he wrote. “I'm committed to making Facebook the leader in transparency and control around privacy.”

The news of the settlement with the FTC comes days after Facebook announced it may go public.